Thursday, 16 July 2009

Just received this in my inbox, and thought it was rather funny. Why you ask? Well first - this scammer evidently didn't bother taking the time to at least try and make the scam look legit, and second, other than "WEBMAIL E-mail messaging center", there's no company or website specified - something you're err, meant to include if you're trying to scam users of a particular website or service.

I thought at first, that the e-mail had just been converted to text by my e-mail client, but nope, it was already this apparently in plain text, complete with the god awful formatting.

Dear e-mail user, This message is from WEBMAIL E-mail messaging center to all our email account users. We are currently conducting a maintenance exercise which is for upgrading our database and e-mail account center Thisexercise involves the deactivation of dormant /unused/invalid email accounts to make room for further upgrading. To confirm the validity of your email and to prevent your account from deactivation, you are advised to update it by proving us with the following information to alexeifamily@cooperation.netCONFIRM YOUR EMAIL IDENTITY BELOW Email Username: EMAIL Password: Date of Birth:

Warning!!! Account owners are expected to update their accounts within 10 working days after receipt of this notice. Failure to comply with this notice within the stipulated time will face the risk of loosing his or her account.

Thanks for your co-operation! Warning Code: VX2G99AAJ Web Team BETA!

The e-mails headers show only a single fake Received From line, with the real originating IP being;

The e-mail address they want you to respond to is alexeifamily@cooperation.net, a Brazillian website hosted at 80.80.229.46 (AS21217 - CH-SAFEHOST, PTR: www.cooperation.net), though unless I'm mistaken, it appears to be a French free e-mail account provider? (pretty wierd considering it's WhoIs references Brazil and Switzerland - not France).